One of the biggest obstacles a prospective client faces when considering a mobile forensic investigation is getting possession of the phone. Possession of the device is not the only obstacle. Perhaps the client is worried about the subject noticing the absence of their phone or tablet. These two issues present the biggest wall thrown up to clients thinking about contracting and examiner to carry out a mobile forensic investigation. At Integrity Investigations, we are one of the only companies around that has answer to these two huge obstacles and it is just another way we stand out as a company that goes the extra mile for its clients.
Ok so you have decided a mobile forensic investigation is right for you. However, you are a bit discouraged when a representative at your local investigation firm informs you that they would need to physically have possession of the device in order to carry out an investigation. If you are dealing with subject who is particularly attached to their phone, you know this is not an option. However, if you can get access to the phone for about an hour, our examiner can come to you and do an on-site acquisition. Upon completion, the client retains possession of the phone. Our examiner then takes the image of the device back to the lap for investigation (remember an image is an exact copy of the client’s device.)
Sometimes, even obtaining the device for an hour is out of the question. When this is the case we offer cloud analysis of iPhones (currently only iPhones and iDevices.) If the client knows the password for iCloud, our examiner can use one of our forensic tools to make an image of the backup of the device stored on the cloud. A backup is almost as good as having possession of the phone itself and from it the examiner can pull almost anything that was on the device at the moment of the backup (think of a iBackup as a snapshot of the device and everything on it at the moment the backup was made).
Recently we were contacted by a client who suspected his wife of infidelity. Our examiner went to meet the client to do an onsite acquisition, but the phone was not where it was expected to be. Not to be deterred, our examiner asked the client if he knew the iCloud username and password for the account. Luckily, the client had the information and the examiner was able to connect and forensically download a backup image of the phone. With this image, the examiner uncovered texts and e-mails that confirmed the client’s suspicions.
Offering onsite and cloud acquisition allows integrity investigations to go the extra mile for our clients. If you cannot attain the device in question, don’t let that stop you! We can either come to you and make an image of the device or, in some case, we can even pull information from the cloud without having the device in hand. These two capabilities allow us to circumvent two of the most common issues clients face when considering a mobile forensic examination. So, if you can’t get access to the device you want examined, don’t fret! We can still help!